PaperlayerView exact revision on arXiv

Source-linked AI summary

Enhancing Adversarial Example Transferability with an Intermediate Level Attack

Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, Ser-Nam Lim

arXiv:1907.10823v3cs.LGcs.CRcs.CVstat.ML

TL;DR

Black-box transferability is limited because adversarial examples often overfit their source models. ILA fine-tunes existing examples by increasing perturbation at a selected intermediate layer, improving transferability across models and datasets while allowing source-only layer selection.

  • Problem

    Adversarial examples can transfer between models, but source-model overfitting makes black-box success rates lower than white-box success rates.

  • Method

    ILA fine-tunes a pre-generated adversarial example by increasing its perturbation on a pre-specified intermediate layer, with projection and flexible loss variants.

  • Results

    ILA substantially increases transferability across evaluated models and datasets, including ImageNet, and surpasses TAP and the Xie et al. attack.

  • Takeaways & Limitations

    A near-optimal target layer can be selected using the source model alone, without knowledge of transfer performance or target models.

  • Takeaways & Limitations

    Future work is needed to extend ILA to universal or targeted perturbations and explore other intermediate-feature attacks.

Abstract

from arXiv · show

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model, improving upon state-of-the-art methods. We show that we can select a layer of the source model to perturb without any knowledge of the target models while achieving high transferability. Additionally, we provide some explanatory insights regarding our method and the effect of optimizing for adversarial examples using intermediate feature maps. Our code is available at https://github.com/CUVL/Intermediate-Level-Attack.

1. Introduction

Adversarial examples can transfer across models, but source-model overfitting limits black-box success. ILA fine-tunes existing examples by increasing perturbation at a selected intermediate layer to improve transferability.

  • Black-box attacks expose a practical vulnerability because attackers typically receive only model predictions, not architecture or gradients.
  • White-box adversarial examples sometimes transfer, but their black-box success rates are usually lower because attacks overfit the source model.
  • Intermediate feature maps may permit larger perturbation norms without changing image-space perceptibility, motivating intermediate-layer optimization.
  • ILA fine-tunes a given adversarial example by increasing its perturbation on a pre-specified intermediate layer of the source model.
  • The paper evaluates ILA across multiple models and datasets, reports improvements over state-of-the-art methods, and provides explanatory insights into intermediate-feature optimization.
  • A source-model-only procedure selects a layer intended to maximize transferability without evaluating transfer models during hyperparameter optimization.

2. Background and Related Work

Prior attacks mainly optimize source-model outputs or decision boundaries, while transfer-oriented methods differ in whether they use ensembles, intermediate layers, or newly generated perturbations. ILA instead fine-tunes existing adversarial examples around selected feature representations.

  • General adversarial attacks: FGSM and related gradient methods increase final-layer loss through input-space perturbations, while DeepFool approaches decision boundaries iteratively.
  • Model ensemble attack: Model-based ensembling improves transfer by using multiple models, and aligned CNN decision boundaries make examples fooling several models more likely to fool others.
  • Intermediate-layer methods: Some prior methods perturb intermediate activations, but feature-space attacks may target internal representations rather than explicitly emphasizing black-box transferability.
  • TAP and ILA: TAP maximizes perturbation norms across all layers, whereas ILA exploits a specific layer’s representations and fine-tunes an existing adversarial example.

3. Approach

ILA starts from an existing adversarial example and optimizes a selected intermediate representation as a directional guide. Its projection and flexible losses trade off increasing disturbance magnitude with preserving the adversarial direction.

  • ILA framework: ILA defines F_l(x) as a network’s output at layer l and uses the pre-specified layer to guide adversarial-example refinement.
  • ILA framework: The algorithm takes an original image, a baseline adversarial example, an intermediate-layer function, an L∞ bound, learning rate, iterations, and a loss function.
  • ILA framework: ILA initializes x′′ from the original image and iteratively updates it under the perturbation bound before returning the refined example.
  • ILAP loss: The intermediate disturbance Δy′_l = F_l(x′) − F_l(x) serves as a directional guide for constructing a more transferable adversarial example.
  • ILAP loss: ILAP uses a projection objective that maximizes disturbance in the direction of the existing intermediate-layer perturbation.
  • ILAF loss: ILAF separates direction preservation from magnitude maximization and controls their trade-off with an additional parameter α.
  • ILA framework: Both variants iteratively approximate their maximization objectives, and the attack is treated as fine-tuning a pre-generated adversarial example.

4. Results

Across CIFAR-10 and ImageNet experiments, ILAP improves adversarial-example transferability over baseline and state-of-the-art attacks. Its source-model-only layer-selection procedure identifies nearly optimal transfer settings, while ILAF can improve results further with additional tuning.

  • 4.1. ILAP Targeted at Different L Values: ILAP increases transferability against I-FGSM, MI-FGSM, and Carlini-Wagner across CIFAR-10 models, using 10 iterations initialized from 20-iteration baseline attacks.The evaluated architectures are ResNet18, SENet18, DenseNet121, and GoogLeNet.
  • 4.2. ILAP with Pre-Determined L Value: ILAP selects a nearly optimal layer using only the source model, avoiding hyperparameter tuning through evaluation on transfer models.The selection is based on the relationship between transferability and layer disturbance values.
  • 4.4. ImageNet Results: On ImageNet, ILAP improves transferability and surpasses the state-of-the-art TAP and Xie et al. attacks.Experiments use ResNet18, DenseNet121, SqueezeNet, and AlexNet, with transfer evaluated over all 50,000 ImageNet test images.
  • 4.1. ILAP Targeted at Different L Values: ILAP outperforms I-FGSM for every tested intermediate layer on ResNet18, with especially strong performance at the optimal value l = 4.Transfer is measured on DenseNet121, SENet18, and GoogLeNet using CIFAR-10 accuracies, where lower accuracy indicates a better attack.
  • 4.2. ILAP with Pre-Determined L Value: The latest disturbance peak usually identifies the adversarial examples with the highest transferability across transferred models.For ResNet18, the procedure selects l = 4 and produces an optimal or near-optimal attack according to Table 2.
  • 4.3. ILAF vs. ILAP: ILAF improves over ILAP with an additional α hyperparameter, but its optimal α varies by model and requires substantial tuning.ILAP is described as working well out of the box, whereas ILAF is more model-specific.

5. Explaining the Effectiveness of Intermediate Layer Emphasis

ILAP’s transferability varies across intermediate layers because alignment with the Best Transfer Direction and decision-boundary linearity improve at different rates. Transferability peaks before excessive linearity in the final layers becomes detrimental, while source-model performance can continue improving.

  • Best Transfer Direction: The Best Transfer Direction (BTD) is the normalized perturbation that fools the largest set of distinct CNNs, serving as a transferability reference.ILAP uses the original perturbation as an approximation of this direction, so better alignment should improve transfer performance.
  • Angle and alignment: As layer indices increase, I-FGSM becomes more closely aligned with the estimated BTD, increasing transfer attack success.The alignment is measured by the angle between feature-map perturbations from I-FGSM and a multi-fool perturbation.
  • Angle and alignment: Using a multi-fool perturbation as ILAP’s starting guide substantially improves performance, especially at earlier layers where I-FGSM approximates the BTD poorly.The improvement is smaller in later layers, where I-FGSM is already a better BTD approximation.
  • Decision-boundary linearity: Increasing layer depth makes the mapping to the output more linear, improving ILAP’s linear decision-boundary approximation, but the final layers can become too linear relative to the transfer boundary.The authors associate extreme linearity in the last several layers with poorer ILAP performance.
  • Optimal layer: Transferability rises while alignment and useful linearity improve, then falls when excessive source-model linearity dominates; the layer immediately before this switch is optimal.This explains why selecting the latest layer that still produces a peak provides a near-optimal transfer layer without evaluating target models.
  • Source-versus-transfer behavior: On the source model, ILAP performance improves toward later layers because transfer-specific factors do not apply and the linearity factor continues to help optimization.At the final layer, ILAP is equal to or better than the baseline attacks used by the authors.

6. Conclusion

The paper introduces ILA to improve adversarial-example transferability by targeting intermediate layers, while identifying layer selection and feature-space behavior as central findings. It also outlines extensions and supplementary analyses for broader attack settings and mechanisms.

  • 6. Conclusion: ILA enhances the transferability of a given adversarial example by increasing its projection onto the Best Transfer Direction.The framework includes two variants, ILAP and ILAF.
  • 6. Conclusion: Specific intermediate layers substantially increase transferability relative to attack baselines, and a near-optimal layer can be selected without target-model transfer information.
  • 6. Conclusion: Future work includes studying interactions with existing attacks, extending ILA to universal or targeted perturbations, and exploring other intermediate-feature-space attacks.
  • 6. Conclusion: The supplementary material provides expanded network descriptions, layer selections, disturbance graphs, ILAP–ILAF comparisons, ImageNet results, decision-boundary visualizations, learning-rate ablations, and CIFAR-10 comparisons with TAP.

A. ILAP Network Overview and Results for Other Base Attacks

The appendix evaluates ILAP across multiple base attacks and CIFAR-10 architectures, using layer-specific intermediate outputs and a fixed iterative baseline. Additional results include I-FGSM, FGSM, and DeepFool, with DeepFool requiring clipping to satisfy the perturbation constraint.

  • A. ILAP Network Overview and Results for Other Base Attacks: ILAP is tested against MI-FGSM, C&W, TAP, I-FGSM, DeepFool, and FGSM on ResNet18, SENet18, DenseNet121, and GoogLeNet trained on CIFAR-10.
  • A. ILAP Network Overview and Results for Other Base Attacks: For each source model, intermediate output block, and attack, baseline adversarial examples use 20 iterations, while ILAP examples use the attack with 10 iterations as a reference.
  • A. ILAP Network Overview and Results for Other Base Attacks: Additional results cover I-FGSM, FGSM, and DeepFool, with DeepFool outputs clipped to satisfy the ϵ-ball constraint.
  • A. ILAP Network Overview and Results for Other Base Attacks: The experiment computes average disturbance at each layer for four models to examine how the reference attack and ILA affect intermediate representations.

C. ILAP vs ILAF Full Result

The appendix compares ILAP and ILAF across a range of α values using I-FGSM as the reference attack and the same experimental setting as the main CIFAR-10 experiment.

  • C. ILAP vs ILAF Full Result: ILAP and ILAF are evaluated across a range of α values with I-FGSM as the reference attack, and their results are reported in Figure 13.

D. ILAP on ImageNet Full Result

The appendix evaluates ILAP with I-FGSM and momentum-based I-FGSM on ImageNet across four source models and all 50,000 test images. It also records selected layers and a corrected-normalization note.

  • D. ILAP on ImageNet Full Result: ImageNet transferability is evaluated for ILAP combined with I-FGSM and momentum-based I-FGSM across ResNet18, DenseNet121, SqueezeNet1.0, and AlexNet.
  • D. ILAP on ImageNet Full Result: The evaluation measures target-model accuracies on adversarial examples generated from all 50000 ImageNet test images.
  • D. ILAP on ImageNet Full Result: The appendix lists the selected source-model layers for ResNet18 and DenseNet121, including convolutional, block, transition, normalization, and classifier layers.
  • D. ILAP on ImageNet Full Result: A footnote states that previous paper versions included results with incorrect normalization.
  • D. ILAP on ImageNet Full Result: Table 4 reports ILAP results based on I-FGSM and DeepFool, while its caption notes that DeepFool’s large transfer improvement starts from poor original transfer rates.

G. Learning Rate Ablation

The ablation fixes 20 iterations for both I-FGSM variants, varies learning rates on ResNet18, and evaluates generated adversarial examples across models.

  • 20 iterations are used for both I-FGSM and I-FGSM with Momentum.
  • Learning-rate experiments are conducted on ResNet18 for both attack variants.
  • Model accuracies are evaluated on 1,600 generated adversarial examples.The evaluation uses 50 × 32 examples.

H. Comparison to TAP [33]

The comparison evaluates ILAP against TAP on CIFAR-10, using TAP-generated adversarial examples as inputs and reporting results across supplementary experiments and visualizations.

  • Comparison setup: CIFAR-10 results compare 20 iterations of TAP with 10 iterations of ILAP applied to a 10-iteration TAP attack.
  • Comparison setup: Table 8 reports the ILAP-versus-TAP comparison, with TAP hyperparameters specified for the experiment.The settings include lr = 0.002, ϵ = 0.015, λ = 0.005, α = 0.5, s = 3, and η = 0.01.
  • Additional analyses: The supplementary material includes disturbance graphs, transferability graphs, decision-boundary visualizations, and comparisons on CIFAR-10 and ImageNet.
Loading 1907.10823v3…